cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
348
Views
0
Helpful
2
Replies

Identify source address?

jedavis
Level 4
Level 4

I have a Tachyon satellite backup router connected to a 3750 switch port that seems to be getting traffic from somewhere. I don?t have a sniffer at that location. Does anyone have any tricks that would allow me to identify where this traffic is coming from? I thought about using a MAC ACL and a Vlan map, denying all traffic and logging the output until I found out that Vlan maps do not support logging. This is a switched port, not a routed port. Either ource MAC or IP would be fine.

2 Replies 2

albert.remo
Level 1
Level 1

Hi!

Good day! IP accounting is a good IOS tool but unfortunately, as I've checked, this is not supported on the 3750 switch. What you can do is configure SPAN then use a protocol analyzer from your PC. Ethereal is a good tool and if I'm not mistaken can be downloaded free.

Hope this helps,

Regards,

Albert

Thank you for the reply Albert.

Actually, I think IP accounting IS supported on the 3750, but this doesn't help on a switched port where IP processing does not take place.

I am very familiar with Ethereal and I may have to resort to having someone at the site load it onto something, but I was hoping for a quick and dirty method from the switch command line.

FYI Ethereal, while still available by that name, is no longer being supported. It is now known as Wireshark and is available from http://www.wireshark.org/. I think there were some trademark disputes or something.

-Jeff

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: